Every connected product runs on code its maker didn’t write. Cars, infusion pumps, baby monitors, routers and grid equipment all ship with third-party libraries and firmware components, and the build manifest rarely tells the whole story. Finite State’s business is finding out what’s actually in the shipped device. On November 10 the Columbus, Ohio company announced a $27 million Series C to scale that work.
Private funds managed by The O.H.I.O. Fund led the round, with CIBC Innovation Banking, Energy Impact Partners, Energize Capital and National Grid Partners joining. The investor list says something on its own: two of the backers are energy and grid investors. Utilities buy a lot of connected equipment they can’t easily inspect.
Binary analysis, not paperwork
Most software supply chain tools start from what developers declare. Finite State analyses the compiled software and firmware inside finished products, so manufacturers can see the gap between what they meant to ship and what runs on the device. The platform then generates SBOMs, VEX statements and signed compliance packages.
A customer at JET Optoelectronics, a Tier 1 automotive electronics supplier, singled out the depth of binary and firmware analysis and the visibility into direct and transitive dependencies. Finite State says its customers include national power grids, a US national security research lab, global automakers and medical device makers.
The Vulnpocalypse framing
The company is leaning on a term that took off in October, when AI-assisted research exposed serious flaws in widely deployed software, a PHP vulnerability among them. The time from discovery to working exploit has collapsed from weeks to days or hours. CEO Matt Wyckhouse argues this isn’t a one-month event. Device makers can’t patch at cloud speed, so knowing exactly which components are exposed becomes urgent.
Regulation adds the second push. The EU Cyber Resilience Act and similar rules expect connected products to be secure by design and demonstrated before they ship. That turns SBOMs and vulnerability evidence from good practice into a condition of selling in Europe.
The money goes into more autonomous platform capabilities and international expansion. For device makers facing AI-speed exploitation and CRA deadlines at the same time, a tool that reads firmware rather than trusting manifests is the right product at the right moment.